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Information  System  (IS)  audits  conducted  by  the  Legislative  Audit  Division  are  designed  to  assess 
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The  Legislative  Audit  Committee 
Of  the  Montana  State  Legislature: 

This  is  the  report  of  our  Information  System  audit  of  controls  relating  to  the  System  for  the 
Enforcement  and  Recovery  of  Child  Support  (SEARCHS)  at  the  Department  of  Public  Health  and 
Human  Services.  We  reviewed  application  controls  over  the  SEARCHS  application  and  general 
controls  relating  to  access  and  change  controls.  This  report  contains  recommendations  for 
improving  controls  related  to  the  system  and  department  procedures.  Written  responses  to  our 
audit  recommendations  are  included  in  the  back  of  the  audit  report. 
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Chapter  I  -  Introduction  and  Background 


Introduction  We  conducted  an  information  system  audit  of  the  Child  Support 

Enforcement  Division's  (CSED)  System  for  the  Enforcement  and 
Recovery  of  Child  Support  (SEARCHS).  The  purpose  of  the  CSED 
of  the  Department  of  Public  Health  and  Human  Services,  is  to 
achieve  financial  support  for  children  by  establishing,  enforcing,  and 
increasing  parental  awareness  of  parental  obligations.  SEARCHS 
was  implemented  in  June  of  1993  to  meet  the  Federal  Family 
Support  Act  of  1988  requirement  that  all  states  have  a  federally 
certified  automated  child  support  system. 

In  1996,  Congress  passed  the  Personal  Responsibility  and  Work 
Responsibility  Act  (PRWORA)  which  contained  significant  child 
support  legislation.  In  1997,  the  Montana  legislature  passed 
amendments  through  SB374  to  implement  the  requirements  of 
PRWORA.  Key  provisions  of  the  act  include:  employer  reporting 
of  new  hires  to  state  databases  within  20  days  of  hire;  submitting 
child  support  cases  to  a  federal  case  registry;  automating  income 
withholding  notices;  and  data  matches  with  financial  institutions. 

SEARCHS  receives  information  from  a  number  of  automated 
systems  or  departments  including:  TEAMS  (The  Economic 
Assistance  Management  System)  for  public  assistance;  CAPS  (Child 
and  Adult  Protective  Services);  SABHRS  (Statewide  Accounting, 
Budgeting  and  Human  Resource  System);  Department  of  Justice; 
Supreme  Court;  Department  of  Corrections;  Department  of  Labor  - 
Unemployment  Insurance,  Job  Service,  and  Worker's  Compensation; 
Department  of  Revenue  -  New  Hire,  State  Income  Tax,  and 
Employer  Wages;  Fish,  Wildlife,  and  Parks;  Federal  Case  Registry; 
CSENet  (Child  Support  and  Enforcement  Network);  FBI  (Federal 
Bureau  of  Investigation);  Social  Security  Administration;  IRS 
(Internal  Revenue  Service);  Department  of  Defense;  Veteran's 
Administration;  and  Selective  Service. 

There  are  five  regional  offices  that  process  child  support  cases; 
Butte,  Billings,  Great  Falls,  Missoula,  and  the  interstate  office 
located  in  Helena.  The  state  disbursement  unit  for  child  support 
collections  is  also  located  in  Helena.  The  division  had  191.75 
budgeted  full-time  employees  for  Fiscal  Year  2002. 
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As  of  January  31,  2001,  the  division  had  38,671  open  child  support 
cases.  Child  support  collections  in  the  month  of  January  2001  totaled 
$4,190,970,  of  which  $523,061  reimbursed  the  state  for  public 
assistance. 

During  the  audit,  we  reviewed  seven  key  areas.  They  are  case 
initiation  and  locate,  establishment,  enforcement,  financial 
management  and  payment  processing,  reporting,  and  access  and 
change  control  procedures. 

►  Case  initiation  and  locate  involves  the  initial  applicant 
information  entry,  a  search  for  duplicate  records,  securing 
medical  and  financial  support  information,  and  location  of  the 
absent  parent  (AP). 

►  Establishment  includes  paternity  establishment  in  cases  of 
children  born  out  of  wedlock  or  when  the  paternity  of  a  child  is 
in  question,  and  calculation  of  monthly  support  payments  or 
entering  court  ordered  child  support  obligations. 

►  Enforcement  involves  methods  of  trying  to  collect  income  from 
the  AP  such  as  income  withholding,  monthly  billing,  credit 
bureau  reporting,  state  and  federal  tax  refund  offsets,  state  bad 
debt  offsets,  and  unemployment  benefits  locate. 

►  Financial  management  and  payment  processing  includes  the 
processing  of  payments  received,  including,  entry  and  posting  of 
payments,  check  deposit  at  the  Treasury  Unit,  distribution  of 
payments,  check  issuance,  and  reconciliations. 

►  Federal  reports  are  submitted  indicating  performance  standards 
and  results  used  to  calculate  program  grant  amounts. 
Performance  reports  indicate  the  number  of  cases,  collections, 
distribution  of  cases,  and  aging. 

►  Access  security  to  help  ensure  proper  controls  are  in  place  to 
limit  accessibility  to  SEARCHS  case  information  to  appropriate 
personnel. 

►  Change  control  procedures  to  help  ensure  changes  to  the 
SEARCHS  programming  and/or  data  are  authorized  and 
appropriate.  According  to  a  contract  between  the  department 
and  its  consultant,  TRW,  contract  programmers  are  responsible 
for  maintaining  the  SEARCHS  system  and  all  programming 
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Audit  Objectives 


changes.  The  department  has  established  procedures  to  address 
system  changes. 

We  conducted  a  preliminary  review  of  the  Child  Support 
Enforcement  program  laws  and  regulations  to  gain  an  understanding 
of  responsibilities,  and  determine  the  role  the  SEARCHS  system 
plays  in  helping  to  administer  the  program.  Our  objective  is  to 
provide  assurances  over  identified  controls  and  processes,  and  to 
share  our  understanding  of  these  processes  with  others  having  a  need 
for  this  information.  Application  control  testing  reviewed  input, 
processing,  and  output  controls  to  ensure  information  is  processed 
accurately  and  completely.  We  also  evaluated  access  and  change 
control  procedures  over  SEARCHS. 


Audit  Scope  and 
Methodology 


The  audit  was  conducted  in  accordance  with  generally  accepted 
government  auditing  standards  published  by  the  United  States 
General  Accounting  Office.  We  evaluated  current  controls  using 
criteria  established  by  the  AICPA,  and  Control  Objectives  for 
Information  and  Related  Technology  (COBIT)  over  input, 
processing,  and  output,  as  well  as  electronic  security. 


We  performed  testing  to  ensure  there  are  input  controls  in  place  to 
prevent  duplicate  participants,  and  identified  applicable  input  edits. 
We  reviewed  critical  ticklers,  or  reminders,  that  prompt  specific  case 
activity  within  federally  required  timeframes.  We  reviewed  cases 
referred  from  the  public  assistance  system  to  ensure  that  accounts  are 
assigned  and  support  orders  contain  provisions  for  medical  support 
when  appropriate. 

We  identified  controls  in  place  to  ensure  support  orders  are 
established  in  a  timely  manner,  and  enforcement  techniques  initiated 
when  a  case  is  in  enforcement  status.  We  reviewed  department 
procedures  established  to  ensure  withholding  orders  are  issued 
within  two  days  of  new  hire  reports. 


We  identified  controls  over  payment  posting  and  data  input  edits  in 
place  over  payment  posting.  We  verified  there  are  controls  in  place 
to  ensure  payments  are  distributed  within  the  2-day  requirement.  We 
reviewed  reconciliations  being  performed  between  SEARCHS  and 
SABHRS,  and  between  SEARCHS  and  TEAMS  for  monthly 
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distributions.  We  verified  that  the  algorithm  will  distribute  payments 
according  to  federal  regulations.  We  verified  that  there  are  controls 
in  place  for  resolving  prepaid  child  support  claims  to  ensure  money 
is  distributed  appropriately. 

We  reviewed  the  listing  of  child  support  collections  that  were  not 
posted  because  of  errors  or  missing  information  to  ensure  they  are 
being  resolved  in  a  timely  manner.  We  verified  that  access  to 
confidential  reports  listing  federal  tax  information  is  controlled. 

We  reviewed  critical  system  tables  to  ensure  information  was 
accurate  according  to  applicable  regulations.  We  reviewed  the 
access  control  structure  for  SEARCHS  and  access  to  critical  screens. 
We  reviewed  programmer  access  to  SEARCHS  to  ensure  that  it  was 
appropriate,  and  identified  change  control  procedures  to  ensure 
system  changes  are  controlled. 


Compliance  We  tested  compliance  with  certain  state  and  federal  regulations 

relating  to  administration  of  child  support.  We  determined  the 
department  to  be  in  compliance  with  tested  regulations,  except  for 
the  following: 

►  Collections  in  excess  of  public  assistance  reimbursement  should 
be  distributed  to  the  custodial  parent.  (Recommendation  #1 ) 

►  Assigned  accounts  are  not  setup  on  SEARCHS  for 
reimbursement  of  public  assistance.  (Recommendation  #1 ) 

►  Support  Orders  for  public  assistance  recipients  are  not  being 
modified  to  include  medical  support.  (Recommendation  #3) 
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Chapter  II  -  Application  Controls 

Child  support  collected  on  behalf  of  an  individual  receiving  public 
assistance  is  "assigned"  or  paid  to  the  state  for  reimbursement  of  that 
assistance.  According  to  federal  regulations,  by  signing  the 
application  for  public  assistance,  the  applicant  has  automatically 
assigned  and  transferred  all  rights  to  child  support  to  the  State  of 
Montana,  Department  of  Public  Health  and  Human  Services.  The 
CSED  is  responsible  for  setting  up  assigned  accounts  on  the 
SEARCHS  system  and  pursuing  the  absent  parent  for  child  support. 
CSED  is  also  responsible  for  notifying  the  public  assistance 
caseworker  if  the  applicant  is  not  cooperating,  and  flagging  the 
applicant  on  the  SEARCHS  system  using  a  non-cooperation  code. 


During  the  audit,  we  reviewed  public  assistance  cases  referred  in  the 
month  of  February  2001 ,  to  ensure  collections  are  appropriately 
assigned  to  the  state.  We  determined  the  automated  interface 
between  SEARCHS  and  TEAMS,  the  public  assistance  system,  is 
not  working  accurately.  Some  cases  referred  by  TEAMS  are  not 
being  received  by  SEARCHS,  non-cooperation  codes  are  not  being 
interfaced  back  to  TEAMS,  and  as  a  result,  caseworkers  are  not 
performing  necessary  actions  in  the  required  timeframes. 

If  child  support  collections  are  received  and  an  assigned  account  is 
not  setup  on  SEARCHS,  the  state  will  not  be  reimbursed  for  public 
assistance.  Consequently,  the  custodial  parent  incorrectly  receives 
payment  for  both  public  assistance  and  child  support. 


Distributing  Excess 
Collections 


We  also  determined  the  monthly  public  assistance  reimbursement 
amount  does  not  reconcile  between  SEARCHS  and  the  public 
assistance  system.  Each  month,  the  difference  between  the  child 
support  collections  and  public  assistance  is  calculated  by  SEARCHS, 
and  any  amount  of  collections  exceeding  the  public  assistance 
amount  is  to  be  paid  to  the  custodial  parent.  The  division  has  not 
been  paying  parents  receiving  public  assistance  the  excess 
collections  due  to  the  unreconciled  difference. 


According  to  PRWORA,  any  child  support  retained  over  the 
reimbursed  assistance  amount  is  owed  to  the  custodial  parent.  It  is 
the  CSED's  fiduciary  responsibility  toward  the  obligor  and  obligee 
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in  their  role  as  a  collector  of  unpaid  child  support  to  distribute  money 
collected  promptly. 

As  of  May  5,  2001,  a  system-generated  report  identifies  a  total  of 
$8 1 3,336  potentially  owed  to  custodial  parents.  We  identified  a  case 
where  the  payment  has  been  outstanding  since  1993,  and  another 
custodial  parent  showing  a  balance  of  $4,692. 

Department  personnel  stated  they  are  aware  the  interface  is  not 
working  accurately,  but  have  not  been  able  to  isolate  the  problems 
with  the  interface  because  they  are  focusing  programming  efforts  on 
PRWORA  certification.  The  division  is  currently  working  on 
reconciling  the  total  amount  due  on  accounts  or  determining  whether 
the  money  belongs  to  the  state.  Personnel  indicated  they  have  had 
problems  determining  the  total  dollar  amount  of  public  assistance 
because  some  of  the  records  were  purged  from  the  TEAMS  system. 
Once  CSED  is  confident  money  is  owed,  personnel  said  they  intend 
to  distribute  the  payments. 


Recommendation  #1 


We  recommend  the  division: 

A.  Resolve  programming  problems  to  ensure  that  data 
interfaces  completely  and  accurately. 

B.  Reconcile  current  open  TEAMS  cases  with  SEARCHS  cases 
to  ensure  that  assigned  cases  are  set  up  appropriately. 

C.  Distribute  excess  reimbursed  public  assistance  amounts  to 
custodial  parents.  


Invalid  or  Missing  Social 
Security  Numbers 


Social  security  numbers  (SSN)  are  used  for  the  majority  of 
enforcement  techniques  to  identify  sources  of  income  that  could  be 
collected  for  the  custodial  parent.  For  example,  SEARCHS 
interfaces  with  state  and  federal  new  hire  systems  to  identify  new 
sources  of  income.  It  is  a  federal  regulation  to  issue  a  withholding 
order  within  2  days  of  a  new  hire  referral.  The  new  hire  referral  is 
based  on  an  exact  match  between  name  and  social  security  number. 
During  the  audit  we  identified  807  absent  parents  with  a  current, 
open  child  support  case  having  invalid  SSNs  on  the  system.  These 
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numbers  are  invalid  because  the  system  shows  either  a  blank  or  zero 
in  the  SSN-designated  field,  or  the  first  three  numbers  of  the  SSN 
have  not  been  issued  to  a  state  by  the  Social  Security  Administration. 
If  an  invalid  social  security  number  is  used  there  will  never  be  a 
match  with  resource  information.  As  a  result,  income  will  not  be 
collected  and  paid  to  the  custodial  parent. 

During  the  audit,  we  identified  two  people  that  are  assigned  more 
than  one  participant  ID.  Payments  are  distributed  based  on  the 
participant  ID.  If  an  absent  parent  has  multiple  participant  ID's  the 
payments  will  not  be  distributed  accurately. 

Department  personnel  indicated  they  were  in  negotiations  with  the 
Social  Security  Administration  in  2000  to  update  their  agreement  and 
social  security  number  interface  capabilities,  but  have  not  worked  on 
the  agreement  further  because  they  have  been  working  on 
certification  requirements.  However,  the  department  already 
interfaces  with  Social  Security  Administration  for  social  security 
numbers  on  its  public  assistance  system. 


Recommendation  #2 


We  recommend  the  division: 

A.  Correct  invalid  or  missing  social  security  numbers  for  absent 
parents  currently  on  the  SEARCHS  system,  and 

B.  Establish  procedures  to  ensure  that  absent  parent 
information  includes  a  valid  social  security  number. 


Modification  of  Support 
Orders 


While  caseworkers  are  reviewing  documentation  to  establish  a  case, 
they  review  the  support  order  in  effect.  A  medical  insurance 
indicator  is  entered  on  the  SEARCHS  system  indicating  any  medical 
support  required.  They  also  verify  that  it  is  a  Montana  order  because 
they  do  not  have  jurisdiction  over  orders  issued  in  another  state. 


During  the  audit,  we  identified  433  child  support  cases  with  a 
Montana  support  order,  where  each  case  is  an  open  assigned  account 
for  public  assistance  reimbursement;  however,  the  order  omitted 
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medical  support.  As  a  result,  additional  expenses  for  medical 
payments  may  be  incurred  through  Medicaid. 

According  to  federal  regulations,  the  division  must  attempt  to  secure 
medical  support  information,  and  establish  and  enforce  medical 
support  obligations  for  all  individuals.  If  the  child  does  not  have 
satisfactory  health  insurance  other  than  Medicaid,  federal  regulations 
require  the  agency  to  petition  the  court  or  administrative  authority  to 
include  medical  support  in  all  new  or  modified  orders  of  support. 
CSED  policy  states  that  they  must  "Ensure  that  all  support  orders 
enforced  by  the  CSED  include  a  provision  for  the  health  care 
coverage  of  the  .children". 

Division  personnel  stated  that  they  have  not  been  modifying  support 
orders  because  of  a  ruling  by  the  Supreme  Court  of  Montana 
enjoining  CSED  from  modifying  support  orders  issued  by  a  Montana 
District  Court.  However,  nothing  in  this  ruling  prevents  them  from 
petitioning  the  District  Court  to  modify  the  order  to  include  medical 
support,  in  accordance  with  federal  law. 

During  the  57th  legislative  session  the  department  was  granted  the 
authority  to  administratively  modify  orders  effective  July  1,  2001 . 


Recommendation  #3 


We  recommend  the  division  ensure  medical  support  obligations 
are  included  in  Montana  support  orders  for  public  assistance 
recipients,  in  accordance  with  federal  regulations.     


Inaccurate  Bank  Account 
Number 


Custodial  parents  can  authorize  CSED  to  deposit  money  collected  for 
child  support  directly  into  their  checking  or  savings  account.  A 
direct  deposit  authorization  form  must  include  their  name,  social 
security  number,  a  copy  of  a  voided  check  or  deposit  slip,  and  an 
authorization  signature.  The  authorization  forms  are  filed  in  the 
CSED  office.  The  account  information  is  entered  on  the  SEARCHS 
system.  A  test  transaction  is  sent  initially  to  ensure  that  the  bank 
account  number  is  a  valid  account  number,  however,  there  is  no 
review  of  the  input  to  ensure  the  accuracy  of  the  account  number. 
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An  account  number  can  be  valid,  and  still  be  inaccurately  input  as  an 
individual's  account. 

During  the  audit,  we  reviewed  the  system  information  for  duplicate 
bank  account  numbers  to  determine  whether  a  valid  account  was 
entered  for  more  than  one  individual,  and  we  identified  two 
duplicates  where  the  bank  account  numbers  were  incorrectly  entered 
for  the  wrong  custodial  parent.  The  bank  account  number  was  valid, 
but  belonged  to  another  individual  on  the  system. 

We  notified  CSED  personnel  who  promptly  corrected  the 
information.  One  payment  of  S3 10  was  recalled  from  the  inaccurate 
account  and  reissued  to  the  appropriate  person.  The  department 
ensured  no  further  payments  had  processed  to  the  wrong  parent. 
Department  personnel  could  not  determine  why  the  bank  account 
information  had  been  changed,  and  could  not  find  an  authorization 
form  on  file  for  the  parent.  The  critical  nature  of  bank  account 
information  combined  with  the  fact  that  one  person  is  responsible  for 
maintaining  the  information,  should  require  a  level  of  review. 


Recommendation  #4 


We  recommend  the  division  establish  review  procedures  to 
ensure  system  bank  account  information  is  input  accurately 
based  on  supporting  documentation. 


Resolution  of  Payment 
Exceptions 


Child  support  collections  are  recorded  daily  to  the  CSED  collection 
system.  This  system  feeds  the  payment  information  to  the 
SEARCHS  system.  A  report  listing  all  payment  exceptions  is 
generated  daily.  Examples  of  exceptions  include  warrants  less  than 
$10.00;  unknown  addresses;  payments  requiring  manual 
intervention;  no  open  account  associated  with  participant  making 
payment;  and  unknown  participant  making  the  payment. 
Each  of  the  adjusters  is  assigned  a  region  to  review  exceptions  and 
perform  adjustments.  Most  of  the  exceptions  have  to  be  reviewed  by 
caseworkers,  who  inform  the  adjuster  of  the  needed  change  prior  to 
releasing  the  payment.  Until  payment  exceptions  are  resolved  by 
CSED  the  custodial  parent  does  not  receive  their  entitled  support. 
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We  reviewed  the  listing  of  outstanding  payment  exceptions  on 
March  21,  2001  and  identified  490  payment  exceptions  that  had  been 
unresolved  for  more  than  two  weeks,  totaling  $40,744.  Two  of  the 
payments  have  been  on  the  exception  report  since  May  of  1993. 
There  were  exceptions  totaling  $8,159  where  the  absent  parent 
making  the  payment  is  not  recognized  by  the  SEARCHS  system. 

Federal  law  requires  the  state  to  distribute  all  amounts  collected 
within  two  business  days  after  receipt  if  sufficient  information 
identifying  the  payee  is  provided.  However,  there  are  no  policies  or 
procedures  outlining  the  division's  responsibility  for  resolving 
payment  exceptions  in  a  timely  manner.  The  division  should 
consider  its  fiduciary  responsibility,  and  establish  procedures  to 
promptly  resolve  payment  exceptions. 


Recommendation  #5 


We  recommend  the  division  establish  procedures  for  prompt 
resolution  and  distribution  of  child  support  payment  exceptions. 


Unreconciled  Differences 


Division  personnel  perform  daily  reconciliations  to  ensure: 

►  The  child  support  receipts,  which  are  primarily  checks  and 
Electronic  Funds  Transfer  (EFT)  transactions,  compare  to  the 
amount  posted  to  the  payment  system; 

►  The  amount  posted  to  the  payment  system  completely  interfaced 
to  the  SEARCHS  system;  and 

►  The  SEARCHS  system  completely  interfaced  to  SABHRS. 

A  monthly  reconciliation  is  also  performed,  comparing  the  amount 
that  is  distributed  for  reimbursement  for  public  assistance.  We 
identified  the  following  reconciliation  discrepancies: 

►  Division  personnel  keep  a  manual  listing  of  the  daily  cash 
receipts  collected  on  assigned  accounts,  for  reimbursement  of 
public  assistance.  At  month-end,  the  reimbursement  is 
distributed  to  the  public  assistance  programs.  For  the  month  of 
March  2001,  the  daily  receipts  on  assigned  accounts  totaled 
$699,558,  but  the  distribution  report  generated  by  SEARCHS 
indicated  the  amount  to  be  distributed  was  $738,496.  As  a  result 
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the  division  distributed  $38,937  more  than  the  daily  collection 
reports  indicate  it  received  for  the  month. 

►    Based  on  the  daily  cash  reconciliations,  the  undistributed  cash 
balance  does  not  reconcile  between  SABHRS  and  SEARCHS. 
As  of  March  2001,  the  SEARCHS  undistributed  cash  balance 
was  $937,484  and  the  SABHRS  undistributed  cash  balance 
amount  was  $859,449,  a  difference  of  $78,035. 

Although  department  personnel  are  performing  periodic 
reconciliations,  discrepancies  should  be  identified  and  resolved  in  a 
timely  manner  to  ensure  accountability  and  adequacy  of  fund  assets 
to  cover  child  support  payments  due  to  custodial  parents. 

Division  personnel  are  currently  working  on  identifying  why  the 
difference  in  public  assistance  reimbursements  occurred.  Personnel 
indicated  the  undistributed  cash  balance  difference  occurred  because 
they  never  had  a  report  to  reconcile  against.  Personnel  stated  that 
once  the  difference  no  longer  fluctuates,  they  will  make  a  one-time 
adjustment. 


Recommendation  #6 


We  recommend  the  division  resolve  differences  identified  in 
monthly  distribution  amounts  for  public  assistance 
reimbursement  and  ensure  SEARCHS  reconciles  with  SABHRS. 


Access  Controls 


Access  controls  provide  electronic  safeguards  designed  to  protect 
computer  system  resources,  and  limit  accessibility  to  confidential 
information. 


SEARCHS  is  a  mainframe  application  requiring  multiple  layers  of 
security.  The  mainframe's  security  software  establishes  user  groups. 
Each  of  the  over  300  SEARCHS  screens  is  associated  with  a  user 
group.  In  addition  to  the  mainframe  security  software,  SEARCHS 
uses  security  tables  to  restrict  access.  However,  for  those  screens 
without  a  security  table  setup,  system  hard-coded  programming 
further  restricts  SEARCHS  security. 

We  reviewed  users  with  the  ability  to  modify  data  in  the  SEARCHS 
system  and  identified  the  following: 
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►  Nineteen  contract  programmers  have  unrestricted  access  to  the 
production  programs  and  data,  including  access  to  make 
adjustments  to  payments  and  accounts.  Industry  standards  warn 
that  no  one  should  have  incompatible  duties  that  would  permit 
the  perpetration  and  concealment  of  material  errors  and 
irregularities.  Due  to  the  high  degree  of  technical  knowledge, 
programmers  should  not  have  access  to  production  programs  and 
files.  Their  programming  activities  should  be  restricted  to  test 
programs  and  files.  Once  the  programming  changes  have  been 
tested  and  approved  on  the  test  system,  department  personnel 
should  be  responsible  for  transferring  the  changes  to  production. 

►  We  identified  57  users  with  access  to  SEARCHS  that  are  either 
no  longer  employed  with  the  department  or  no  longer  require 
access  to  the  database.  Although  they  have  access  to  the 
SEARCHS  layer  of  security,  they  do  not  have  access  to  the 
mainframe  level  of  security  so  data  could  not  be  modified.  If  the 
employee's  mainframe  access  was  restored,  the  SEARCHS 
system  access  is  also  restored,  without  department  notification. 

►  We  identified  36  of  47  users  with  unnecessary  access  to  perform 
adjustments  according  to  their  required  job  duties.  Adjustments 
are  a  critical  function  within  SEARCHS  that  should  be  restricted 
since  adjustments  can  include  the  amount  of  cash  collected, 
account  balances,  and  monthly  obligations. 

Proper  access  controls  aid  in  the  prevention  and  detection  of 
deliberate  and  accidental  errors  caused  by  improper  use  or 
manipulation  of  data,  programs,  and/or  computer  resources.  Limited 
access  based  on  job  duties  prevents  users  from  inadvertently  or 
willingly  changing  data  unrelated  to  their  job. 

During  the  audit,  we  interviewed  numerous  department  personnel 
from  within  and  external  to  the  CSED,  regarding  the  SEARCHS 
security  structure.  No  one  was  knowledgeable  of  how  security  in 
SEARCHS  is  controlled  including  personnel  responsible  for 
determining  the  level  of  access  a  user  is  assigned.  Appropriate 
division  personnel  should  obtain  an  understanding  of  SEARCHS 
security  architecture  and  periodically  review  employee  access  for 
appropriateness. 
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Recommendation  #7 


We  recommend  the  division: 

A.  Obtain  an  understanding  of  SEARCHS  security 
architecture. 

B.  Remove  programmer  access  to  production  programs  and 
data. 

C.  Deactivate  terminated  employee  IDs. 

D.  Establish  procedures  to  periodically  review  access  to 
SEARCHS. 


Timely  Review  of  Case 
Information 


A  monthly  caseload  report  is  issued  to  each  of  the  caseworkers  and 
the  regional  supervisors  listing  each  case  that  is  assigned  to  them. 
This  report  lists  the  participants  in  the  case,  the  status  of  the  case  and 
the  date  that  the  case  was  last  "touched"  or  reviewed.  Because 
information  changes,  it  is  important  to  continually  review  case  files 
regarding  locate,  paternity,  or  enforcement  information.  The  system 
provides  a  date  field  that  is  to  be  updated  after  the  caseworker 
performs  the  review.  We  reviewed  all  open  cases  on  the  SEARCHS 
system  as  of  March  31,  2001,  and  identified  10,037  cases  where  the 
date  field  indicated  the  case  had  not  been  reviewed  in  the  last  90 
days.  The  system  indicates  217  had  not  been  reviewed  in  over  a 
year,  and  one  case  that  had  not  been  reviewed  since  1995. 


According  to  department  policy,  CSED  requires  each  case  must  be 
"touched"  at  least  once  every  90  days.  Touching  a  case  is  defined  as 
reviewing,  and  if  appropriate,  taking  action  to  ensure  federal  and 
state  compliance.  Policy  further  states,  upon  completion,  the  date 
field  must  be  updated. 

If  cases  are  not  reviewed,  necessary  actions  may  not  be  completed 
and  the  case  may  not  be  in  compliance  with  applicable  federal 
regulations. 

Division  personnel  stated  they  have  not  enforced  the  policy  because 
caseworkers  can  update  the  date  indicating  that  a  review  was 
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completed  when  no  action  has  been  taken.  Personnel  stated  they  rely 
on  the  department's  annual  internal  review  to  identify  instances 
where  appropriate  actions  have  not  been  taken  on  cases. 


Recommendation  #8 


We  recommend  the  division  either  enforce  its  policy  to  ensure 
child  support  cases  are  reviewed  every  90  days  or  modify  the 
policy  to  ensure  that  appropriate  actions  are  completed. 


Resolution  of  Case 
Ticklers 


A  tickler  is  an  indicator,  or  a  reminder,  that  an  action  is  necessary  on 
a  child  support  case.  Ticklers  are  generated  based  on  events 
occurring  in  a  case,  or  can  be  created  manually  by  the  caseworker. 
The  SEARCHS  ticklers  were  created  to  help  caseworkers  manage 
their  caseloads  more  effectively,  and  to  ensure  that  required  actions 
are  completed  in  a  timely  manner  according  to  applicable  federal 
policies.  A  tickler  is  considered  outstanding  when  the  dated 
completion  has  expired. 


During  the  audit,  we  determined  14  of  20  caseworkers  reviewed  had 
outstanding  ticklers,  six  caseworkers  had  50  or  more  outstanding 
ticklers,  and  one  caseworker  had  266  outstanding  ticklers. 

According  to  department  policy,  CSED  caseworkers  must  review 
and  reconcile  the  ticklers  on  a  daily  basis.  Policy  further  states,  it  is 
essential  that  ticklers  be  resolved  immediately.  Ticklers  that  are 
unresolved  hinder  the  achievement  of  the  CSED's  performance  and 
collection  goals.  Unresolved  ticklers  could  result  in  non-compliance 
with  federal  policy  regarding  completion  within  required  time  limits. 

According  to  division  personnel,  regional  managers  are  supposed  to 
enforce  the  tickler  policy.  The  list  of  outstanding  ticklers  is 
supposed  to  be  reviewed  and  evaluated  by  the  regional  manager  at 
the  time  of  each  caseworker's  performance  appraisal.  Division 
personnel  were  unaware  that  the  policy  was  not  being  enforced  and 
plan  to  inform  managers  of  their  responsibility. 
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Recommendation  #9 


We  recommend  the  division  enforce  policies  regarding  review 
and  resolution  of  case  ticklers  and  continually  monitor  caseload 
ticklers. 
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DEPARTMENT  OF 
PUBLIC  HEALTH  AND  HUMAN  SERVICES 


AUG    2  2001 


JUDY  MARTZ 
GOVERNOR 


GAIL  GRAY,  Ed.D. 
DIRECTOR 


STATE  OF  MONTANA 


July  31,  2001 


Mr.  Scott  A.  Seacat 

Legislative  Auditor 

Office  of  the  Legislative  Auditor 

State  Capitol,  Room  160 

Helena,  Montana  59620-1705 

Dear  Mr.  Seacat: 

Attached  are  the  Department  of  Public  Health  and  Human  Services 
responses  to  the  recommendations  made  in  the  information  systems  audit 
of  the  System  for  the  Enforcement  and  Recovery  of  Child  Support 
(SEARCHS) . 

We  appreciate  the  effort  that  has  gone  into  your  examination  of  the 
functioning  of   SEARCHS  and  would  like  to  thank  your  staff  for  their 
efforts  in  identifying  areas  where  we  can  improve  the  operation  of  the 
SEARCHS  system. 

Please  contact  me  if  you  have  questions. 


Sincerely, 


Cc    Amy  Pfeifer 

Marie  Matthews 
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Recommendation  #1 

We  recommend  the  division: 

A.  Resolve  programming  problems  to  ensure  that  data  interfaces  completely  and  accurately. 

B.  Reconcile  current  open  TEAMS  cases  with  SEARCHS  cases  to  ensure  that  assigned  cases  are  set  up 
appropriately. 

C.  Distribute  excess  reimbursed  public  assistance  amounts  to  custodial  parents. 

Concur. 

The  Department  continues  work  on  the  accuracy  and  completeness  of  TEAMS/SEARCHS  interfaced  data 
Procedures  are  in  place  to  monitor  and  correct  interface  discrepancies  until  long  term  solutions  are  developed. 
The  department  has  completed  a  review  of  all  public  assistance  cases  identified  as  "referred"  by  TEAMS  and 
worked  with  TRW  to  ensure  the  electronic  referral  was  received  by  SEARCHS.   The  department  is  currently 
reviewing  a  report  of  TEAMS  Medicaid  cases  to  ensure  all  appropriate  referals  are  made  to  SEARCHS. 

The  Department  continues  to  work  diligently  to  identify  and  pay  all  excess  reimbursed  public  assistance  amounts 
to  custodial  parents.   Progress  has  been  slowed  by  significant  data  processing  issues  and  programming  resource 
constraints  but  the  department  commits  to  reconcile  the  "potentially  owed'  report  and  refund  all  appropriate 
entities. 


Recommendation  #2 

We  recommend  the  division: 

A.  Correct  invalid  or  missing  social  security  numbers  for  absent  parents  currently  on  the  SEARCHS  system,  and 

B.  Establish  procedures  to  ensure  that  absent  parent  information  includes  a  valid  social  security  number. 

Partially  Concur. 

While  the  CSED  strives  to  validate  100%  of  these  SSNs,  this  is  a  difficult,  if  not  impossible,  task.  On  average, 
the  CSED  opens  575  new  cases  each  month.   Often,  the  applicant  will  not  know  the  SSN  of  the  absent  parent  and, 
therefore,  will  be  unable  to  provide  this  information  to  the  CSED  on  the  application.   It  would  not  be  justifiable  or 
allowable  for  the  CSED  to  deny  child  support  services  simply  because  the  applicant  does  not  know  the  absent 
parent  s  SSN.   CSED  will  open  the  case  on  SEARCHS,  but  leave  the  SSN  information  blank.   After  loading  the 
case,  the  CSED  will  take  action  to  find  the  SSN  through  several  steps.   Typically,  with  the  absent  parent's  name 
and  date  of  birth,  the  CSED  will  be  able  to  successfully  identify  the  SSN  by  accessing  its  locate  tools  through  a 
name  search.   There  are,  however,  instances  when  the  CSED  does  not  know  the  name,  correct  or  full  name,  or 
date  of  birth  of  the  absent  parent.   In  circumstances  where  the  name  of  the  absent  parent  is  unknown,  the  CSED 
will  conduct  an  in-person  interview  with  the  applicant  in  an  effort  to  gather  additional  locate  information  for  the 
case.    Once  the  SSN  is  found,  it  will  be  loaded  on  system.   If  the  CSED  cannot  locate  the  absent  parent,  after 
regular  locate  attempts  over  a  three-year  period,  the  CSED  will  contact  the  applicant  to  state  its  intention  to  close 
the  case. 

For  purposes  of  uniformity  in  identifying  cases  with  unknown  SSNs,  CSED  policy  will  be  provided  to  staff 
requiring  the  discontinuance  of  placing  zeros  or  "999-99-9999"  into  the  SSN  field  for  the  absent  parent.   If  the 
SSN  cannot  be  validated,  staff  will  be  instructed  to  leave  this  field  blank. 


Recommendation  #3 
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We  recommend  the  division  ensure  medical  support  obligations  are  included  in  Montana  support  orders  for  public 
assistance  recipients,  in  accordance  with  federal  regulations. 

Concur. 

Presently,  all  child  support  orders  administratively  established  by  the  CSED  contain  a  medical  support  provision. 

However,  not  all  support  orders  issued  by  Montana  Distric  Courts  contain  a  Medical  support  provision.  During 
the  2001  legislative  session,  the  CSED  pursued  legislation  amending  our  authority  to  administratively  modify 
district  court  child  support  orders,  in  compliance  with  the  Seubert  v.  Seubert  decision  of  the  Montana  Supreme 
Court,  issued  August  31,  2000  and  clarified  November  30,  2000.   The  legislation  was  effective  July  1,  2001. 
Based  on  this  legislation,  the  CSED  has  recently  implemented  procedures  to,  again,  pursue  the  review  and 
modification  of  child  support  orders  issued  by  a  Montana  district  court.   With  this  ability,  the  CSED  will  be  able 
to  have  medical  support  obligations  incorporated  into  orders  through  the  review  and  modification  process. 

Recommendation  #4 

We  recommend  the  division  establish  review  procedures  to  ensure  system  bank  account  information  is  input 
accurately  based  on  supporting  documentation. 

Concur. 

The  Department  agrees  with  the  recommendation.   The  CSED  will  develop  additional  procedures  to  ensure  bank 
account  information  is  input  accurately  based  on  supporting  documentation. 

Recommendation  #5 

We  recommend  the  division  establish  procedures  for  prompt  resolution  and  distribution  of  child  support  payment 
exceptions. 

Concur. 

The  CSED  Fiscal  Operations  Section  has  begun  actively  investigating  and  responding  to  all  payments  on  the 
exceptions  reports.   Policies  and  procedures  will  be  developed  to  address  all  types  of  situations  identified  via  the 
reviews,  including  issuing  a  problem  report  should  SEARCHS  programming  be  necessary. 


Response  to  Recommendation  #6 

We  recommend  the  division  resolve  differences  identified  in  monthly  distribution  amounts  for  public  assistance 
reimbursement  and  ensure  SEARCHS  reconciles  with  SABHRS. 

Concur. 

Two  additional  reports  have  been  requested  to  assist  in  the  CSED  reconciliation  of  SEARCHS  cash  with 
SABHRS  cash.   Once  programming  resources  are  available,  the  report  will  be  produced  and  CSED  will  be  able  to 
continue  the  analysis. 

Recommendation  #7 
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We  recommend  the  division: 

A.  Obtain  an  understanding  of  SEARCHS  security  architecture. 

B.  Remove  programmer  access  to  production  data. 

C.  Deactivate  terminated  employee  IDs. 

D.  Establish  procedures  to  periodically  review  access  to  SEARCHS. 


Partially  Concur. 

We  believe  that  all  documentation  of  the  security  architecture  exists  and  are  moving  forward  to  accumulate  the 
information  in  one  location.   Should  the  project  determine  additional  training  is  needed  it  will  be  provided  to  staff 
as  necessary.   The  department  will  develop  procedures  to  ensure  deactivation  of  employee  access  upon 
termination  of  employment  and  to  periodically  review  access  to  SEARCHS. 

Removing  programmer  access  to  the  production  database  may  not  be  a  viable  option  for  the  department.   We 
commit  to  looking  at  the  issue  and  choosing  a  course  of  action  that  produces  the  best  results  for  the  program  and 
it's  clients. 


Recommendation  #8 

We  recommend  the  division  either  enforce  its  policy  to  ensure  child  support  cases  are  reviewed  every  90  days  or 
modify  the  policy  to  ensure  that  appropriate  actions  are  completed. 

Concur. 

The  CSED  will  retain  its  current  policy  to  review  each  of  its  cases  every  90  days.  Clarification  on  the  use  of  the 
caseload  report  and  the  date  field  has  been  provided  to  regional  staff.    CSED  Central  Office  will  periodically  review 
a  random  sample  of  selected  cases  from  the  division-wide  caseload  report  to  ensure  compliance  with  the  policy. 


Recommendation  #9 

We  recommend  the  division  enforce  policies  regarding  review  and  resolution  of  case  ticklers  and  continually  monitor 
caseload  ticklers. 

Concur. 

CSED  will  reiterate  to  staff  and  management  the  importance  of  addressing  ticklers  in  a  timely  fashion  in  the  next 
CSED  Management  Memo.  CSED  will  continue  to  rely  on  findings  from  its  annual  Self-Assessment  Review  to 
monitor  compliance  of  casework  time  frames  defined  in  federal  regulations.        — ~ 
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